A security auditor reviews a company's network and notes that it relies on a single perimeter firewall as its only protective measure. If an attacker bypasses this firewall, they gain unrestricted access to all internal systems. The auditor recommends adding endpoint antivirus, internal network segmentation, host-based firewalls, and access controls at multiple layers. Which security concept is the auditor promoting?